Bug 724972 – gjs-console crashed with SIGSEGV in g_bytes_unref()

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 724972 - gjs-console crashed with SIGSEGV in g_bytes_unref()


Summary:	gjs-console crashed with SIGSEGV in g_bytes_unref()


Status:	RESOLVED INCOMPLETE

Product:	gjs
Classification:	Bindings
Component:	general
Version:	1.39.x
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	gjs-maint
QA Contact:	gjs-maint

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2014-02-22 20:52 UTC by Cristian Aravena Romero
Modified:	2014-09-04 10:51 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Cristian Aravena Romero 2014-02-22 20:52:18 UTC

Open bug in launchpad.net
https://bugs.launchpad.net/ubuntu/+source/gjs/+bug/1283203

"gnome-maps crashed when closing.

$ gnome-maps

(gnome-maps:10968): GLib-CRITICAL **: Source ID 68 was not found when attempting to remove it

(gnome-maps:10968): GLib-CRITICAL **: Source ID 114 was not found when attempting to remove it
Gjs-Message: JS LOG: creating soup

(gnome-maps:10968): GLib-CRITICAL **: Source ID 579 was not found when attempting to remove it

(gnome-maps:10968): GLib-CRITICAL **: Source ID 18496 was not found when attempting to remove it

(gnome-maps:10968): GLib-CRITICAL **: Source ID 24840 was not found when attempting to remove it

(gnome-maps:10968): GLib-CRITICAL **: Source ID 25012 was not found when attempting to remove it
Gjs-Message: JS LOG: Failed to connect to GeoClue2 service: Przekroczono czas oczekiwania

(gnome-maps:10968): GLib-CRITICAL **: Source ID 25055 was not found when attempting to remove it

(gnome-maps:10968): GLib-CRITICAL **: Source ID 28768 was not found when attempting to remove it
Naruszenie ochrony pamięci (core dumped)"

+ Trace 233218

#0 ??
#1 g_bytes_unref
at /build/buildd/glib2.0-2.39.90/./glib/gbytes.c line 309
#2 g_slist_foreach
at /build/buildd/glib2.0-2.39.90/./glib/gslist.c line 877
#3 g_slist_free_full
at /build/buildd/glib2.0-2.39.90/./glib/gslist.c line 172
#4 g_memory_input_stream_finalize
at /build/buildd/glib2.0-2.39.90/./gio/gmemoryinputstream.c line 140
#5 g_object_unref
at /build/buildd/glib2.0-2.39.90/./gobject/gobject.c line 3112
#6 object_instance_finalize
at gi/object.cpp line 1334
#7 finalize
at /build/buildd/mozjs24-24.2.0/js/src/jsobjinlines.h line 213
#8 finalize<JSObject>
at /build/buildd/mozjs24-24.2.0/js/src/jsgc.cpp line 331
#9 FinalizeTypedArenas<JSObject>
at /build/buildd/mozjs24-24.2.0/js/src/jsgc.cpp line 395
#10 FinalizeArenas
at /build/buildd/mozjs24-24.2.0/js/src/jsgc.cpp line 432
#11 finalizeNow
at /build/buildd/mozjs24-24.2.0/js/src/jsgc.cpp line 1306
#12 js::gc::ArenaLists::queueObjectsForSweep
at /build/buildd/mozjs24-24.2.0/js/src/jsgc.cpp line 1402
#13 BeginSweepingZoneGroup
at /build/buildd/mozjs24-24.2.0/js/src/jsgc.cpp line 3677
#14 BeginSweepPhase
at /build/buildd/mozjs24-24.2.0/js/src/jsgc.cpp line 3761
#15 IncrementalCollectSlice
at /build/buildd/mozjs24-24.2.0/js/src/jsgc.cpp line 4289
#16 GCCycle
at /build/buildd/mozjs24-24.2.0/js/src/jsgc.cpp line 4422
#17 Collect
at /build/buildd/mozjs24-24.2.0/js/src/jsgc.cpp line 4558
#18 gjs_context_dispose
at gjs/context.cpp line 344
#19 g_object_unref
at /build/buildd/glib2.0-2.39.90/./gobject/gobject.c line 3075
#20 main
at gjs/console.cpp line 134

Comment 1 Giovanni Campagna 2014-02-24 14:40:19 UTC

I can see three explanations here:

1) A toggle ref issue, dupe of bug 697436
2) A resurrection bug, similar to bug 725024 (and the associated gnome-shell bug)
3) Some wrong transfer annotation

Unfortunately I cannot reproduce the bug with gjs and gnome-maps master, so can you ask the original reporter to rerun the app under valgrind?
Running against a libmozjs compiled with --enable-debug --enable-threadsafe would be awesome too.

Comment 2 Jasper St. Pierre (not reading bugmail) 2014-02-24 14:45:15 UTC

Probably fixed with:

https://git.gnome.org/browse/gjs/commit/?id=a2160ffa92fd290279a9dee872ca360d84773f93

The fast path there is broken. See:

https://git.gnome.org/browse/gjs/commit/?id=49eb746a0bcaf054fb7a5d879f4e2da28044f50d

for a more complete explanation.

Comment 3 André Klapper 2014-09-04 10:51:56 UTC

Closing this bug report as no further information has been provided. Please feel free to reopen this bug if you can provide the information asked for in comment 1. Thanks!